drm/amdgpu: Fix potential fence use-after-free v2

jira SECO-48
cve CVE-2023-51042
commit 2e54154

fence Decrements the reference count before exiting.
Avoid Race Vulnerabilities for fence use-after-free.

v2 (chk): actually fix the use after free and not just move it.

    Signed-off-by: shanzhulig <[email protected]>
    Signed-off-by: Christian König <[email protected]>
    Reviewed-by: Alex Deucher <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    (cherry picked from commit 2e54154)
Signed-off-by: Ronnie Sahlberg <[email protected]>

Author: ciq-sahlberg

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

@@ -1522,15 +1522,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
 			continue;
 
 		r = dma_fence_wait_timeout(fence, true, timeout);
+		if (r > 0 && fence->error)
+			r = fence->error;
+
 		dma_fence_put(fence);
 		if (r < 0)
 			return r;
 
 		if (r == 0)
 			break;
-
-		if (fence->error)
-			return fence->error;
 	}
 
 	memset(wait, 0, sizeof(*wait));